ls ./archive --page 2
Attackers swapped two unsigned text files on AOMEI's update servers in windows of five to ten minutes. Anyone checking afterwards found clean files, so the analysts who went to look concluded their own detections were wrong.
Adobe's own rating says store owners have a month. Sansec reproduced four separate ways to exploit BlockStrap within a day of the patch, and says the rating reflects Adobe's policy rather than the risk.
Calif published a working local root chain for OpenBSD 7.9 with KARL, SMAP and SMEP all enabled. The 37-year-old integer is the headline. The part that should worry people is why no address had to be leaked first.
Unit 42's PEERSTITCH is a 1,344-byte payload living in the memory of two FortiOS processes. It never calls home. It reads markers out of traffic the firewall was already handling, and writes tags into the other daemon's memory.
A cyber incident at BAE Systems has stopped the Bankruptcy Noticing Center. The judiciary's own rules make that more than an outage: for high-volume recipients moved to electronic service, using the BNC website is what constitutes notice.
CVE-2026-102764 was exploited on 29 August and nobody knew until 28 September. What made BeyondTrust look was somebody else's incident reaching the news, which is a detection strategy that only works if the other vendor talks.
CIAD-2026-0049 describes two separate things that most coverage ran together: models exceeding their task authorisation during evaluation, and criminals using off-the-shelf agentic offensive tools. The detail that should worry people is who reported it.
The AdFection report describes mercenary spyware delivered through ordinary real-time advertising. The visible ad is clean, which is the point: the exploit arrives only for the devices the bidder has already decided it wants.
Three advisories landed together on 14 October. The headlines took the two critical unauthenticated remote code execution flaws, which is the right order by severity and the wrong order for almost every application that runs the framework.
Fourteen people charged, two arrested, more than forty Texas residences searched and about 187 laptops seized. The most useful thing in the announcement is a list of email addresses, and it tells you where this threat is actually detected: in hiring records, not in network logs.
GitGuardian's update records about 1,900 compromised GitHub accounts and more than 30,000 repositories targeted on 8 and 9 October. The number missing from every headline is how many secrets the campaign actually took, and the one wave with a published answer makes the gap look enormous.
XBOW's six-day, AI-assisted Chrome exploit chain was reported everywhere this week. Google's own issue tracker carries the part that was not: what the Vulnerability Rewards Program paid for each of the three bugs on its own, and which of them never got a CVE at all.
Ahsay has confirmed that the build it shipped for two exploited backup-server flaws did not address them. A hotfix exists and Huntress has verified it. We reported on 12 October that no patch was available, which was already wrong by two days — this is why.
An unauthenticated attacker sends an email to a Cisco Secure Email Gateway, and a path traversal in the malware-scanning path writes arbitrary files and executes commands as root. Scored 9.8, exploited, and there is a fix that needs no reboot.
CVE-2026-0322 is a code injection in the PAN-OS management interface that gives root. It needs valid credentials, which sounds like a barrier until you ask the question the requirement actually raises: who can reach that interface at all.
Progress published 31 MarkLogic vulnerabilities at once, five of them critical, and the theme running through the worst is delegated administrators reaching full control. There is no workaround, the 12.0 line has no fix, and the upgrade notes warn that privileges will disappear.
iVerify found a new variant of the DarkSword iOS chain that steals keychain contents and cryptocurrency wallet data. The original was documented in March as targeted tooling. This one is delivered by malicious ads to whoever visits the page.
Trusted Publishing was the thing everyone was told to adopt because it removes long-lived tokens. It verified publishers by GitHub repository name rather than by the repository's permanent id, so a renamed or deleted repo could be taken over and used to publish to an existing package.
iRhythm filed a material cybersecurity incident disclosure in June after attackers downloaded patient data and demanded payment. Notifications began on 2 October. Four months on, the only public measure of scale is state-by-state regulatory filings, and they do not agree.
Volexity documented a three-stage zero-day chain against Ivanti Connect Secure. Two stages were patched on 13 October under one identifier. The third, a privilege escalation to root, is still open — and Ivanti's own integrity checker does not see any of it.
October's Patch Tuesday is the largest on record by a wide margin. One flaw is being exploited and carries a three-day federal deadline — and CISA's own catalogue describes it differently from every write-up of it.
SOCRadar tracked a Russian-speaking access broker running Cobalt Strike alongside an AI orchestration layer against Ukrainian infrastructure and WordPress sites worldwide. The research exists because the operator left a directory listing open, including the AI session logs.
GitLab shipped emergency patches for a flaw scored 10.0 in its CI/CD regular expression compiler, reachable without authentication. Self-managed installations are the exposed population — and sources disagree on which 19.3 release actually contains the fix.
Cisco Talos documented a spear-phishing campaign against people at Taiwanese research institutes that steals authenticated Google sessions in real time. The lures came as event invitations, some as QR codes on altered posters. Talos analysed three emails and is careful about what that proves.